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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



VIETNAM VETERANS OF AMERICA, INC., 
8605 Cameron Street, Suite 400, 
Silver Spring, MD 20910, 

CITIZEN SOLDIER, INC., 
267 Fifth Avenue, Suite 901, 
New York, NY 10016, 

NATIONAL GULF WAR RESOURCE 
CENTER, INC., 

3027 Walnut St., 
Kansas City, MO 64108, 

RADIATED VETERANS OF 
AMERICA, INC., 
2533 N. Carson Street, 
Carson City, Nevada 89706, 

VETERANS FOR PEACE, INC., 
216 South Meramec Ave., 
SaintLouis, MO 63105, 

Charles L. CLARK, 
1245 Akele St., 
Kailua, HI 96734, 

David CLME, 

17 Pierce Avenue #1, 

Jersey City, N J 07307, 

James E. MALONE, 
2002 S. Norton St., 
Tucson, AZ 85713, and 

John ROWAN, 

8605 Cameron Street, Suite 400, 

Silver Spring, MD 20910, 

Plaintiffs, 



Case No. 



EXHIBIT 



A 
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V. 



R. James NICHOLSON, in his Official Capacity 
as Secretary of Veterans Affairs, 
810 Vermont Avenue, NW, 
Washington, DC 20420, and 

UNITED STATES DEPARTMENT OF 
VETERANS AFFAIRS, 
810 Vermont Avenue, NW, 
Washington, DC 20420, 

Defendants. 



COMPLAINT 

COME NOW PLAINTIFFS, Vietnam Veterans of America, Inc., Citizen Soldier, Inc., 
National Gulf War Resource Center, Inc., Radiated Veterans of America, lac. Veterans For Peace, 
Inc., Charles. L. Clark, David CHne, James E. Malone, and John Rowan, and in support of their 
Complaint herein allege as follows: 

NATURE OF THE ACTION 

1 . This is an action for declaratory and injunctive relief and money damages for the 
violations of the Administrative Procedures Act and the Privacy Act of 1974. Plaintiffs represent 
approximately 26,500,000 individuals who have suffered emotional trauma and been placed in fear 
of identity theft, destruction of credit, and jBnancial fraud because of Defendants' reckless disregard 
for the privacy of these citizen's basic personal information. 

2. Defendant Nicholson failed to properly perform the duties of the duties of his position 
as Secretary of Veterans Affairs ("Secretary") and did not ensure Plaintiffs' privacy rights were 
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protected from the intentional, willful, arbitrary and capricious actions and inactions of his 
subordinates. 

3. Defendant United States Department of Veterans Affairs ("Department" or "VA") 
flagrantly disregarded the privacy rights of essentially every living man and woman to have worn a 
United States military uniform, and perhaps others, by illegally maintaining a database of personal 
information unrelated to claims for benefits. 

4. Defendant VA arrogantly compounded it disregard for veterans' privacy rights by 
recklessly failing to make even the most rudimentary effort to safeguard this trove of the personally 
identifiable information from unauthorized disclosure. Thus, the information was unencrypted, 
easily copied, and, apparently, available to anyone aware of its existence. VA's failure, despite 
repeated calls for correction of these long-standing, fundamental security deficiencies, allowed 
millions of citizen's private information to be surreptitiously disclosed to unknown individuals for 
unknown purposes. 

5. The result of Defendants' reckless disregard of Plaintiffs' privacy rights was the 
largest unauthorized disclosure of Social Security numbers in history. 

6. Defendants' actions and inactions have inflicted, and will long continue to inflict, real 
costs and emotional pain and suffering on Plaintiffs and every other living veteran and their famiHes. 

JURISDICTION AND VENUE 

7. Jurisdiction of this Court is invoked pursuant to 28 U.S.C. §'1331 because this is a 
civil action arising under the laws of the United States. Jurisdiction is also invoked pursuant to 5 
U.S.C. §§ 552a(g)(l), (5) because this is a civil action to enforce a liability created under 5 U.S.C. 
§ 552a after September 27, 1975. 
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8. Venue is appropriate in this Court pursuant to 28 U.S. C. § 1391 because a substantial 
part of the events or omissions giving rise to the claims occurred in this district. 

PARTIES 

PLAINTIFFS 

9. Plaintiff Vietnam Veterans of America, Inc. ("VVA") is a Congressionally-chartered 
national veterans' service organization. Many of the group's individual members and their famiUes 
are in receipt of, or are seeking entitlement to, VA benefits. VVA assists disabled veterans and their 
famiUes, both members and non-members, in the prosecution of claims for benefits by providing 
them with j^ra bono legal representation before the VA, the Board of Veterans Appeals and the U.S. 
Court of Appeals for Veterans Claims. VVA's advocacy on behalf of all veterans extends to the 
legislative arena. WA has approximately 53,400 members, all of whom are believed to be 
identified in Defendant's lost records. 

1 0. Plaintiff Citizen Soldier, Inc. is a non-profit active duty military and veterans' rights 
advocacy organization. The organization advocates for the rights of American military veterans and 
active duty personnel over a wide range of issues, including the Agent Orange Utigation. Citizen 
Soldier has also organized educational and advocacy campaigns, via publications and the internet, on 
a range of health and safety issues of concern to veterans. Citizen Soldier currently has 
approximately 7,200 members nationwide, of which approximately 1,500 are military veterans. 

1 1 . Plaintiff National Gulf War Resource Center, Inc. is a national coalition of more than 
twenty Gulf War veterans advocacy groups founded in 1995 to assisting military veterans of 
operations in the Persian Gulf Region from 1990 to the current day. The organization advocates for 
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scientific research and VA medical care and benefits related to the health issues of veterans of 
Persian Gulf conflicts. 

12. Plaintiff Radiated Veterans of America, Inc. is a non-profit organization dedicated to 
advocate for, and aid, past, current and future members of the Armed Forces of the United States of 
America who were or may be exposed to ionizing radiation in fulfilling their duties, their famihes, 
and survivors. Radiated Veterans of America, Inc. has approximately 40 members, essentially all of 
which are military veterans. 

13. Plaintiff Veterans For Peace, Inc. is a national organization of men and women 
veterans of the Spanish Civil War, World War H, Korea, Vietnam, and other conflicts, as well as 
peacetime veterans. The organization has approximately 4,500 veteran members and 1 ,000 associate 
members organized in chapters across the country. 

14. Plaintiff Charles L. Clark is a veteran of World War 11 and a radiation-exposed 
veteran of the occupation of Nagasaki. Plaintiff Clark has submitted claims for VA benefits for the 
adverse health effects caused by his in-service radiation exposure. 

15. Plaintiff David Cline is a disabled Vietnam combat veteran. During his tour of duty 
as a rifleman with the 25* Infantry Division, he was received three Purple Hearts for wounds 
received in combat, the Bronze Star for bravery, the Combat Infantry Badge, and other Vietnam 
service medals. 

16. Plaintiff James E. Malone is cold war veteran who was exposed to radiation fiom 
United States atomic testing. He has filed claims for benefits with VA for service-connected 
conditions. 
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17. Plaintiff John Rowan is the President of Vietnam Veterans of America and a veteran 
of service in the United States Air Force. 

DEFENDANTS 

18. Defendant R. James Nicholson is the Secretary of Veterans Affairs and is the official 
responsible for the proper execution and administration of all laws administered by the Department 
and for the control, direction, and management of the Department. 

19. Defendant VA is an executive department of the federal government and is, therefore, 
an "agency" for purposes of the Privacy Act of 1974. 

STATEMENT OF THE FACTS 

20. On May 3, 2006, a laptop computer and external data storage device or devices were 

reported stolen from the home of a VA employee. The laptop computer and data storage device or 
devices contained a copy of a collection or grouping of information pertaining to approximately 26.5 
million persons (the "Personal Information"), including military veterans and their spouses. The 
Personal Information contained individual identifying information including, but not limited to, 
names, addresses, phone numbers, social security numbers, and dates of birth. In addition, an 
unknown number of individual's records contained disability information and information related to 
possible exposure to biological and chemical agents. None of the information was encrypted or 
similarly protected. 

2 1 . The incident was the largest unauthorized disclosure of Social Security data ever. The 
disclosure was so patently egregious and unlawful that any reasonable government official would 
have known it to be unlawful. 
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22. The VA employee reported the Personal Information theft to one or more VA 
officials. These VA officials were aware of the egregious and unlawful disclosure of the Personal 
Information soon after the occurrence, yet these VA officials willfully and intentionally decided to 
conceal the disclosure and did not to report the incident to other VA official, federal law 
enforcement, or inform the individuals whose personal information had been disclosed without 
authorization. These failures exhibit Defendants' reckless disregard for Plaintiffs' privacy rights, 
intentional and willfiil violations of the Privacy Act, and were otherwise not in accordance with law. 

23. No VA official charged with protecting the Personal Information pursuant to the 
Privacy Act and who was knowledgeable of the egregious and unauthorized disclosure informed 
Defendant VA's Inspector General of the disclosure. The Inspector General only learned of the 
incident through an offhand remark on May 10, 2006. Then, the Inspector General further 
demonstrated VA's reckless disregard for Plaintiffs' privacy rights and intentional and willfiil 
disregard for Privacy Act requirements by failing to interview the employee in question until May 
15, 2006, five days later. 

24. Defendant Nicholson was informed of the patently egregious and unlawfial disclosure 
on May 16, 2006, but the Federal Bureau of Investigation ("FBF') was not contacted until May 17, 
2006. Defendant Nicholson did not publicly inform Plaintiffs or any other individuals of VA's 
egregious and patently unlawful disclosure of the Personal Information until May 22, 2006, 1 9 days 
after the reported theft. Contrary to Defendant Nicholson's/»o5f hoc public statements this delay was 
not a result of a premeditated plan to avoid public concern, but actually resulted fi-om Defendants 
VA's officials' reckless disregard for Plaintiffs' privacy rights and failure to promptly and 
forthrightly report the disclosure or otherwise observe the procedures required by law. 

7 
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25. Defendants' actions and inactions in failing to report the unauthorized disclosure of 
the Personal Information were arbitrary, capricious and without observance of procedures required 
by law. 

26. Defendant VA has been repeatedly informed of recurring, systemic, and fundamental 
deficiencies in its information security, but failed to effectively respond. VA's own Inspector 
General has for years criticized the Department for lax information security. Despite the repeated 
identification of problems, VA has been unable or unwilling to properly secure the personal 
information under its control. These repeated failures to correct known vulnerabilities of VA's 
safeguards for Plaintiffs' private information demonstrated a reckless disregard for privacy rights and 
intentional or willful violations of the Privacy Act. 

27. The VA employee who reported the laptop computer stolen routinely took sensitive 
private information, including the Personal Infonnation, home since at least 2003. The employee 
had not received a security background check for approximately 32 years. 

28. The Personal Information disclosed on May 3 , 2006, could be retrieved by the name 
of an individual or by some identifying number, symbol, or other identifying particular assigned to an 
individual. 

29. VA flagrantly disregarded Plaintiffs privacy and caused Plaintiffs adverse effects by 
not obtaining prior written consent of Plaintiffs, or any individual, before disclosing the Personal 
Information to any other individual or government agency. 

3 0. V A flagrantly disregarded Plaintiffs ' privacy and caused Plaintiffs ' adverse effects by 
failing to observe the procedures required by law for disclosure of private information, including the 
Personal Information, without the prior written consent of the affected individuals. 
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3 1 . VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
disclosing, or allowed disclosure of, the Personal Information to officials and employees who did not 
have a need for such records and information in the performance of their duties. 

32. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to keep or maintain an accurate accounting of the disclosures of the Personal Information. 

33. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects 
assembling and maintaining the Personal Information in a system of records although the information 
was not relevant and necessary to accompUsh a purpose required by statute or by executive order of 
the President. 

34. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to collect the Personal Information directly firom the subject individuals to the greatest extent 
practicable although the information may result in adverse determinations about an individual's 
rights, benefits, and privileges under a Federal program. 

35. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to publish a notice of the existence and character of the Personal Information system of 
records in the Federal Register. 

36. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to make reasonable efforts to assure that the Personal Information records were accurate, 
complete, timely, and relevant for VA purposes prior to disseminating a record about an individual to 
any person other than an agency. 

37. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to estabHsh or implement appropriate administrative, technical, and physical safeguards to 
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insure the security and confidentiality of records and to protect against anticipated threats or hazards 
to the records security or integrity, which could result in substantial harm, embarrassment, 
inconvenience, or unfairness to any individual on whom information was maintained. VA' s security 
deficiencies allowed, and continue to allow, a single individual to compromise through disclosure the 
entire Personal Information system of records. VA's entrenched unwillingness or inabihty to 
establish and maintain adequate information security is an abuse of discretion and an intentional and 
willfiil failure to observe procedures required by law. 

38. Defendant Nicholson was ultimately responsible for control, direction, and 
management of VA's processes, policies, and procedures for compliance with the Privacy Act of 
1974, including, but not limited to VA Handbook 6300.5, "Procedures for Establishing and 
Managing Privacy Act Systems of Records," but failed to ensure those processes, pohcies, and 
procedures were adequately implemented by his subordinates. Defendant Nicholson knew, or should 
have known, that VA had long-standing information security deficiencies that threatened Plaintiffs' 
privacy rights, but did not ensure correction or mitigation of those deficiencies. 

39. Defendant Nicholson flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' 
adverse effects by failing to estabUsh and ensure lawful compliance by his subordinates with 
appropriate administrative, technical, and physical safeguards to insure the security and 
confidentiality of records and to protect against anticipated threats or hazards to the records security 
or integrity, which could result in substantial harm, embarrassment, inconvenience, or unfairness to 
any individual on whom information was maintained. 



10 
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40. Each of Defendants' failures complained of caused Plaintiffs adverse effects 
including, but not limited to, embarrassment, inconvenience, unfairness, mental distress, emotional 
trauma, pecuniary damages and the threat of current and future substantial harm from identity theft. 

4 1 . The real threat of identity theft and similar adverse effects of VA's illegal actions and 
inactions Privacy Act violations requires affirmative actions by Plaintiffs to recover peace of mind, 
emotional stability, and personal security including, but not limited to, frequently obtaining and 
reviewing credit reports, bank statements, and other similar information, obtaining credit watch 
services, and closing financial accounts. Plaintiffs have, and will continue to, suffer tangible and 
intangible damages for the foreseeable future. 

CLASS ACTION ALLEGATIONS 

42. This action is maintainable as a class action pursuant to Federal Rules of Civil 
Procedure 23(a), (b)(l)-(3). 

43 . The class consists of all persons who have been adversely effected by Defendants' 
APA and Privacy Act violations. 

44. The class is so numerous that joinder of all members is impractible. The class siz.e is 
approximately 26,500,000, which is the number of individuals whose information Defendants admit 
was collected and maintained in the missing system of records. 

45. Joinder of class members' individual actions is impractical because of the 
geographical diversity of class members, the limited ability of individual class members to institute 
separate suits, and the general nature of the underlying action and relief sought. 

46. Class representatives' counsel, Ogletree, Deakins, Nash, Smoak & Stewart, P.C. is 
appropriately qualified and experienced to represent the class. 

11 
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47. There are substantial questions of fact and law common to all class members. The 
legal issues raised in this Complaint are limited to violations of the APA and Privacy Act. The 
factual issues of whether Defendants violated one or more legal requirements are common to all 
class members. Similarly, the relief Plaintiffs seek is dominated by equitable remedies. The facts, 
circumstances, and merits of the case, therefore, apply equally to all class members. 

48. The claims of the representative Plaintiffs are typical of the claims of the class 
members. Representative Plaintiffs are military veterans listed in one or more VA system of records 
who have had their personal information improperly maintained and disclosed by Defendants. 

49. The representative Plaintiffs will fairly and adequately protect the interests of the 
class. Several Plaintiffs have previously come forward, at their own expense, to publicly raise the 
issue of Defendants' conduct. Furthermore, the representative Plaintiffs' claims span the breadth of 
issues raised in this action. 

50. Defendants have acted and refused to act on grounds generally applicable to the class, 
making appropriate final injunctive and declaratory relief with respect to the class as a whole. 

5 1 . The prosecution of separate actions by individual class members would create a risk 
of inconsistent results that could establish incompatible standards of conduct for Defendants. 

52. Defendants' liability for damages can be established by facts and circumstances 
common to the class as a whole and do not require the examination of Plaintiffs' individual 
circumstances. 

53. Questions of law and fact common to members of the class predominate over any 
questions affecting only individual members. 



12 
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54. A class action is superior in this case to other methods for a fair and efficient 
adjudication of the controversy because: (A) the common interests of the class members 
predominate over any individual interest in controlling prosecution or control of separate actions; 
(B) no similar litigation concerning the controversy is known to have been commenced by members 
of the class; (C) concentrating litigation of this action in this Court is appropriate to ensure 
appropriate, consistent, and efficient resolution of the constitutional issues raised in the district 
where the offending conduct occurred, continues to occur, and could occur in the future; and (D) the 
difficulties in managing an action involving this class are significantly reduced by existing databases 
of potential class members prepared by the government and veteran service organizations. 

FIRST CLAIM FOR RELIEF 

Violation of the Administrative Procedures Act 

55. Plaintiffs reassert their allegations set forth in Paragraphs (1) through (54) above and 
incorporate them by reference into this First Claim for Rehef. 

56. Defendant VA possesses personal information of Plaintiffs and milhons of other 
veterans and citizens. VA has repeatedly demonstrated an inability or unwillingness to implement, 
or callous disregard for, fundamental procedures to provide minimally acceptable safeguards for the 
personal and private information in its possession. 

57. Defendant Nicholson is ultimately responsible in his official capacity for safeguarding 
citizen's private information under VA control pursuant to appHcable laws, including the Privacy Act 
of 1974 and the Administrative Procedures Act, but has been unable or unwilling to require 
compliance with those laws. 
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58. Defendants' actions and inactions in failing to safeguard Plaintiffs' private 
information were arbitrary, capricious, and otherwise not in accordance with law. 

59. Plaintiffs suffered, and continue to suffer, harm as a result of Defendants' actions and 
from actions improperly withheld or unreasonably delayed. 

60. Plaintiffs are entitled to equitable relief for Defendants' violation of Plaintiffs' rights 
pursuant to the Administrative Procedures Act. 

SECOND CLAIM FOR RELIEF 

Violation of the Privacy Act 

61 . Plaintiffs reassert their allegations set forth in Paragraphs (1) through (60) above and 
incorporate them by reference into this Second Claim for Relief 

62. Defendants violated the Privacy Act of 1 974. 

63. Each of Defendants' violations of the Privacy Act was intentional or willful. 

64. Each of Defendants' Privacy Act violations caused Plaintiffs adverse effects. 

65. Defendants' unauthorized disclosure of individuals' names, addresses, and phone 
numbers linked to their Social Security numbers has, in particular, placed each Plaintiff in legitimate 
fear of identity theft, corruption of their credit files, and plundering of bank accounts and retirement 
flinds. 

66. Plaintiffs suffered actual damages as a result of Defendants' Privacy Act violations. 

67. Plaintiffs are entitled to monetary rehef and the costs of this action together with 
reasonable attorney fees. 
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PRAYER FOR RELIEF 

WHEREFORE, Plaintiffs pray as follows: 

(a) That this Court issue a declaratory judgment that Defendants violated, and continue 
to violate, Plaintiffs' rights under the Administrative Procedures Act and Privacy Act 
of 1974; 

(b) That this Court order Defendant Nicholson to immediately identify in the Federal 
Register the existence and character of every system of records maintained by VA 
and make available to any individual therein, their authorized representatives, or 
survivors, each record maintained in any VA system of records pertaining to that 
individual; 

(c) That this Court order Defendant Nicholson to immediately identify in the Federal 
Register each use of every system of records, including any vise of that system or 
individuals records thereof knovrai as a "project" or "projects," and the explicit 
statutory or other legal basis for that use or project; 

(d) That this Court permanently enjoin Defendant VA, its officers, agents, employees, 
and those acting for and with them, from accessing, viewing, handling, disclosing, or 
in any way transferring any record or system of records subject to Privacy Act 
requirements until an independent panel of experts finds that adequate information 
security has been established and implemented by VA, unless such activity is 
exphcitly allowed by Court order and under supervision of persons independent of 
VA, such supervision to be at VA expense; 
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(e) That this Court enjoin Defendant VA, its officers, agents, employees, and those 
acting for and with them from removing any device capable of storing, containing, or 
transferring any record or system of records, including, but not limited to, laptop 
computers, portable hard drives, memory stick or similar devices, and "iPods" and 
similar devices, from property under VA's supervision and control until and unless 
VA demonstrates that adequate information security has been estabUshed to the 
Court's satisfaction. 

(f) That this Court grant to Plaintiffs judgment against Defendant VA for damages in an 
amount of $ 1 ,000.00 for each individual w^ho was adversely affected by Defendant' s 
Privacy Act violations; 

(g) That this Court grant to Plaintiffs their costs and reasonable attorney's fees; and 
(h) That this Court grant such additional rehef as the Court deems proper and just. 

Respectfully submitted. 



"L. G^d^e (D.C. Bar No. 421357) 
Douglas4\ Rosinski (D.C. Bar No. 461275) 
Ogletree, Deakins, Nash, 

Smoak & Stewart, P.C. 
1320 Main St. 
Columbia, SC 29201-3266 
Attorneys for Plaintiffs 



DATED: June 6, 2006 



16 



Case 1 :06-cv-01 038-JR Document 9-2 Filed 07/1 0/2006 Page 1 7 of 50 



'4AO440 (Rev. 8/01) Summons in a Civil Action 



United States District Court 

EASTERN District of NEW YORK 



MICHAEL ROSATO, MURRY B. MOSKOWITZ, 

and BRUCE QUELLETTE, on their own behalf 

and on behalf of all others similarly situated, 

V. 

R. JAMES NICHOLSON, in his Official Capadty 

as Secretary of Veterans Affairs, 810 Vermont 

Avenue, NW., (see attachment) 



SUMMONS IN A CIVIL ACTION 




CASENUMBHa; 



ZRACK, 



TO; (Name and address of Defendant) 

R. James Nicholson, in hi§ Official Capacity as Secretary of Veterans 
Affairs and United States Department of Veterans Affairs, 810 Vermont 
Averiue, NW, Washington, DC 20420 



YOU ARE HEREBY SUMMONED and required to serve on PLAINTIFF'S ATTOKNEY (name and address) 

WEISS & LURIE 
551 Fifth Avenue 
NewYork, New York 10176 



an answer to the complaint which is served on you with this summons, within _ 



20 



_ days after service 



of this summons on you, exclusive of the day of service. If you fail to do so, judgment by default will be taken against you 
for the relief demanded in the complaint. Any answer that you serve on the parties to this action must be filed with the 
Clerk of this Court within a reasonable period of time after service. 



mVPf C. WMrM.M^^'^ 



^ 




^>oc. 



3" 



DATE 



-^ 



19 1 



^m^ 



EXHIBIT 
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CIVIL ACTION NO. 




JURY TRIAL DEM^SfeED 



0=1 



ro 






CO 



UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF NEW YORK 

MICHAEL ROSATO, MURRY B. MOSKOWITZ, 
and BRUCE OUELLETTE, on their own behalf and 
on behalf of all others similarly situated, 

Plaintiffs, 



V. 



R. JAMES NICHOLSON, in his Official Capacity 
as Secretary of Veterans Affairs, 
810 Vermont Avenue, NW, 
Washington, DC 20420, and 

UNITED STATES DEPARTMENT OF 
VETERANS AFFAIRS, 
810 Vermont Avenue, NW, 
Washington, DC 20420, 

Defendants. 



COME NOW PLAINTIFFS, Michael Rosato, Murry B. Moskowitz and Bruce Ouellette, 
and in support of their Complaint herein allege as follows: 

NATURE OF THE ACTION 

1 . This is a class action for declaratory and injunctive relief and money damages for 
the violations of the Administrative Procedures Act and the Privacy Act of 1 974 and the Fourth 
and Fifth Amendments to the United States Constitution under the authority oiBivens v. Six 
Unknown Named Agents of the Federal Bureau of Narcotics, 403 U.S. 388 (1971). Plaintiffs 
represent approximately 26.5 million individuals who are both veterans and active service 
members of the Armed Services of the United States who have suffered emotional trauma, have 
been placed in fear of identity theft, destruction of credit and financial fi-aud, and who have had 
their private and personal health care information compromised because of Defendants' 
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intentional, willfiil and reckless disregard for the security and privacy of these citizens' basic 
personal information. 

2. Defendant Nicholson failed to properly perform the duties of his position as 
Secretary of Veterans Affairs ("Secretary") and did not protect the privacy rights of Plaintiffs and 
the other class members and failed to institute and enforce procedures mandated by law for the 
protection of veterans' and service members' private and personal information. 

3 . Defendant United States Department of Veterans Affairs ("Department" or "VA") 
also did not assure that class members' privacy rights were protected, failed to institute and 
enforce procedures mandated by law for the protection of veterans* and service members' private 
and personal information, and flagrantly disregarded the privacy rights of virtually all armed 
service members by illegally maintaining a database.of personal information unrelated to claims 
for benefits and by requiring that veterans' and service members' records be maintained and 
accessed through their individual, private and personal social security numbers or other 
identifiers that were required by law to be kept confidential. 

4. Defendants compounded their disregard for veterans' and service members' 
privacy rights by recklessly failing to make even the most rudimentary effort to safeguard this 
trove of personally identifiable information from unauthorized disclosure. In fact, the 
information was unencrypted, easily copied, and, apparently, available to anyone aware of its 
existence. Defendants' failures, despite repeated calls for correction of these long-standing, 
fundamental security deficiencies, allowed millions of citizens' private information to be 
compromised and disclosed to unknown individuals for unknown purposes. 

5. Defendants improperly, unlawfully, willfully and intentionally disclosed the 
private and personal information of Plaintiffs and the Class in at least three ways: (1) through 
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VA employees' improper access and removal of data files containing the private personal 
information of 26.5 million veterans and active service members from the VA; (2) through the 
transfer by VA personnel of the data to external and unprotected disks and/or computers; and (3) 
through the alleged theft of these disks and/or computers by a third party or parties, whose 
identity may never be known. 

6 . The result of Defendants ' reckless disregard of the privacy rights of the Class was 
the largest unauthorized disclosure of Social Security niimbers, addresses, telephone numbers 
and health information in history. 

7. Defendants' actions and inactions have inflicted serious harm and will continue to 
inflict real costs and emotional pain and suffering on Plaintiffs and every other living veteran and 
their families whose identities and other personal and private information have been 
compromised. 

8. Defendants' willful and intentional failure to establish and enforce appropriate 
safeguards to ensure the security and privacy of veteran records and to protect against any known 
or anticipated threats or hazards to the security and integrity of these records is in violation of 5 
U.S.C. § 552a(e)(10) and other laws. Furthermore, subsequent to learning of the foregoing 
unauthorized disclosures, Defendants were deliberately indifferent in failing to take reasonable 
corrective action, including but not limited to, providing prompt and accurate notification of the 
disclosures to law enforcement and the affected veterans despite knowledge of the substantial 
risk of serious harm to the personal and financial security of the affected veterans as result of the 
disclosures. 
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JURISDICTION AND VENUE 

9. Jurisdiction of this Court is invoked pursuant to 28 U.S.C. § 1 33 1 because this is 
a civil action arising under the laws of the United States. Jurisdiction is also invoked pursuant to 
5 U.S.C. §§ 552a(g)(5) because this is a civil action to enforce a liability created under 5 U.S.C. 

§ 552a after September 27, 1975. 

10. Venue is appropriate pursuant to 5 U.S.C. § 552a(g)(5) and 28 U.S.C. § 1391(e)! 

1 1 . Plaintiff Michael Rosato is a veteran of the United States Armed Services 
honorably discharged from service. He is a resident of Suffolk County, New York. 

12. Plaintiff Murry B. Moskowitz is a veteran of the United States Armed Services 
honorably discharged from service. He is a resident of Fairfax County, Virginia. 

1 3 . Plaintiff Bruce Ouellette is a disabled Vietnam combat veteran and a current 
resident of Yavapai County, Arizona. 

14. Defendant R. James Nicholson is the Secretary of Veterans Affairs and is the 
official responsible for the proper execution and administration of all laws administered by the 
Department and for the control, direction, and management of the Department. 

1 5. Defendant VA is an executive department of the federal government and is, 
therefore, an "agency" for purposes of the Privacy Act of 1974. 

STATEMENT OF FACTS 

1 6. Upon information and belief, VA employees were able to easily access computer 
files containing private Personal Information of millions of veterans and copy the files from the 
VA's system onto external disks and their personal computers. Upon further information and 
belief, VA employees had, in fact, been removing the data from the VA facility for a period of 
three years in a practice expressly or implicitly ratified by the VA. VA employees' access to and 
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duplication of this information was a disclosure in violation of 5 U.S.C. 552a(b) and the result of 
Defendants' willful and intentional failure to establish appropriate safeguards to ensure the 
security and confidentiality of veteran records and to protect against any anticipated threats or 
hazards to the security and integrity of these records in violation of 5 U.S.C. § 552a(e)(10). 

1 7. On May 3, 2006, a laptop computer and external data storage device or devices 
were reportedly stolen from the Aspen Hill, Maryland home of John Doe, a VA employee. The 
laptop computer and data storage device or devices contained a copy of a collection or grouping 
of information pertaining to approximately 26.5 million persons (the 'Tersonal Information"), 
including military veterans and approximately 2.2 million current active service members and 
their spouses (or nearly 80 percent of the active duty force). The Personal Information contained 
individual identifying information including, but not limited to, names, addresses, phone 
nximbers, social security numbers, dates of birth and health information. In addition, at least 
three hundred of the records contained disability information and information related to possible 
exposure to biological and chemical agents. None of tide information was encrypted or similarly 
protected. 

1 8. Upon information and belief, John Doe had removed tihe VA files containing the 
private personal information of 26.5 million veterans from the VA facility and taken it to his 
home shortly before the theft described in the prior paragraph. John Doe then copied the files 
onto his computer and/or external disks for an unspecified purpose, John Doe's computer and/or 
disks were allegedly stolen during a burglary of his home. Upon infonnation and belief, these 
items have not been recovered as of the date of the filing of this Complaint. They were not 
encrypted or password protected and are easily accessed and duplicated. 
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19. John Doe reported the Personal Mormation theft to one or more VA officials. 
These VA officials were aware of the unlawful disclosure of the Personal Information soon after 
the occurrence, yet these VA officials willfully and intentionally decided to conceal the 
disclosure and did not report the incident to other VA officials, federal law enforcement, or 
inform the individuals whose Personal Information had been disclosed without authorization. 
These failures exhibit Defendants' reckless disregard for Plaintiffs' privacy rights, intentional 
and willful violations of the Privacy Act, and were otherwise not in accordance with law. 

20. No VA official charged with protecting the Personal Information pursuant to the 
Privacy Act and who knew of the unauthorized disclosure informed Defendant VA's Inspector 
General George Opfer of the disclosure. The Inspector General only learned of the incident 
through an offhand remark on May 10, 2006. Then, the Inspector General further demonstrated 
VA's reckless disregard for the privacy ri^ts of Plaintiffs and the Class and an intentional and 
willful disregard for Privacy Act requirements by failing to interview the employee in question 
until May 15, 2006, five days later. 

2 1 . Defendant Nicholson was informed of the patently unlawful disclosure on May 
16, 2006, and the Federal Bureau of Investigation ("FBI") was contacted on May 17, 2006. 
Defendant Nicholson did not publicly inform Plaintiffs or any other individuals of VA's patently 
unlawful disclosure of the Personal Information until May 22, 2006, 19 days after the reported 
theft. 

22. Defendants* actions and inactions in failing to report the tmauthorized disclosure 
of the Personal Momiation were arbitrary, capricious and without observance of procedures 
required by law. 
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23 . Defendant VA has been repeatedly informed of recurring, systemic, and 
fundamental deficiencies in its information security, but failed to effectively respond. VA's own 
Inspector General has for years criticized the Department for lax information security. Despite 
the repeated identification of problems, VA has been unable or unwilling to properly secure the 
personal information under its control. These repeated failures to correct known vulnerabilities 
of VA's safeguards for Plaintiffs' and class members' Personal Information demonstrated a 
reckless disregard for privacy rights and intentional or willful violations of the Privacy Act. 

24. VA flagrantly disregarded the privacy of Plaintiffs and the Class and caused them 
adverse effects by failing to observe the procedures required by law for disclosure of private 
information, including the Personal Information, without the prior written consent of the affected 
individuals. 

25. VA flagrantly disregarded the privacy of Plaintiffs and the Class and caused them 
adverse effects by disclosing, or allowing disclosure of, the Personal Information to officials and 
employees who did not have a need for such records and information in the performance of their 
duties. 

26. VA flagrantly disregarded the privacy of Plaintiffs and the Class and caused them 
adverse effects by failing to keep or maintain an accurate accounting of the disclosures of the 
Personal Information. 

27. VA also flagrantly disregarded the privacy of Plaintiffs and the Class and caused 
them adverse effects by assembhng and maintaining the Personal Information in a system of 
records although the information was not relevant and necessary to accomplish a purpose 
required by statute or by executive order of the President. 
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28. Defendants knew or should have known that their computer security practices 

were not in compliance with 5 U.S.C. § 552a as well as other federal laws relating to information 

security. In 2003, a study conducted by the General Accounting Office ("GAO") gave the VA a 

failing grade for its computer security practices. In March 2006, the United States House of 

Representative's Committee on Government Reform gave the VA an "F" in its annual report 

card relating to information security. Despite this ample and specific notice of noncompliance 

and the potential adverse effect of random and unauthorized disclosures of Personal Information, 

Defendants failed to establish appropriate safeguards to ensure the security and confidentiality of 

veteran records and to protect against any anticipated threats or hazards to the security and 

integrity of these records in violation of 5 U.S.C. § 552a(e)(10). 

29. An Associated Press article published on June 14, 2006, concerning that day's 

testimony in Congressional hearings on the compromise of privacy laws at the VA, reported: 

In testimony to Congress, the Government Accountability Office and Veterans 
inspector general detailed ignored warnings, weak management and lax rules in 
their review of VA information security following the theft of 26.5 million 
military personnel's private data last month. 

They found that the Veterans Affairs Department routinely failed to control and 
monitor employee access to private information, did not restrict users to "need-to- 
know" data and often waited too long to terminate accounts when an employee 
quit or was fired. 

The investigators also said the VA lacked a clear chain of command in enforcing 
security, noting the agency will need dramatically stronger leadership under VA 
Secretary Jim Nicholson to force reform after five years of repeated warnings 
about security. 

"Much work remains to be done," Linda Koontz, a director on information 
management at GAO, told the House Veterans Affairs Committee. "Only through 
strong leadership, sustained management commitment and effort, disciplined 
processes, and consistent oversight can VA address its persistent, long-standing 
control weaknesses." 
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30. The testimony of June 14 made clear, according to the foregoing article, that: 

government investigators said the problem was long-standing and much more 
widespread. They pointed to repeated occasions in the last year in which VA 
employees passed along veterans' medical information via unencrypted e-mail or 
were allowed to freely log into the VA secure network in their off-duty hours or 
even after they've been terminated. 

In other instances, files were not adequately segregated or password-protected, 
making it easy for hackers to access the sensitive information. 

3 1 . Finally, the article underscored the fact that the defendants were aware of their 

privacy laws deficiencies for a very long time. 

When the VA was told of problems over the years, often it would make spotty 
improvements but fail to address reform agency-wide. The agency also has yet to 
put in place a security response program to monitor suspicious log-on activity, 
said Michael Staley, an assistant VA inq)ector general, in testimony. 

"These conditions place sensitive information, including financial data and 
sensitive veteran medical and benefit information, at risk, possibly without 
detection of inadvertent or deliberate misuse, fraudulent use, improper disclosure 
or destruction," Staley said. 

32. The unauthorized and unconsented disclosure of an individual's name, address, 
date of birth, health and/or disability status and Social Security number creates a substantial risk 
of identity theft and an invasion of privacy. An individual's Social Security number is the most 
useftil identifier for retrieving information from public record databases, financial institutions 
and credit bureaus. Armed with an individual's name, address, date of birth and Social Security 
number, an identity thief is able to quickly and easily steal an identity, whereas, without such 
information, the task is difficult, time consuming and costly. Moreover, the unauthorized 
disclosure of an individual's health or disability status invades the privacy of information 
protected under law. 
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33. Recent nationwide studies confirai that, on average, victims of identity theft spend 
hundreds of hours in personal'time and hundreds of dollars in personal ftinds to resolve their 
caredit issues. See www.idtheftcenter.org; www.ftctorg. 

34. Defendants' unauthorized and unconsented disclosures of private Personal 
Information and the imminent and substantial risk of identity theft to which the Class has been 
exposed is the direct result of Defendants' failure to: (1) establish appropriate administrative, 
technical and physical safeguards to ensure the security and confidentiality of records; (2) to 
protect against any anticipated threats or hazards to the security and integrity of these records; 
and (3) to promptly take reasonable measures to correct the disclosures, including but not limited 
to, providing law enforcement and the affected veterans with prompt and accxirate notice of the 
disclosures, and free ongoing monitoring of class members' health and financial reports. 

35. As a direct and proximate result of Defendants' acts and omissions, the Class has 
been exposed to a risk of substantial harm and inconvenience, and has incurred actual damages in 
purchasing comprehensive credit reports and/or monitoring of their identity and credit. 
Furthermore, their individual privacy has been invaded through the disclosure of their private and 
personal health information. 

36. Defendant Nicholson was ultimately responsible for control, direction, and 
management of VA's processes, policies, and procedures for compliance with the Privacy Act of 
1 974 and other privacy laws, rules and regulations, but failed to ensure those processes, policies, 
and procedures were adequately implemented by his subordinates. Defendant Nicholson knew, 
or should have known, that VA had long-standing inforaiation security deficiencies that 
threatened the privacy rights of Plaintiffs and the Class, but did not ensure correction or • 
mitigation of those deficiencies. 

10 
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3 7. Defendant Nicholson flagrantly disregarded the privacy rights of Plaintiffs and the 
Class and caused them adverse effects by failing to establish and ensiure lawful conapliance by his 
subordinates with appropriate administrative, technical, and physical safeguards to insure the 
security and confidentiality of records and to protect against anticipated threats or hazards to the 
records security or integrity, which could result in substantial harm, embarrassment, 
inconvenience, or unfairness to any individual on whom information was maintained. 

38. . Each of Defendants' failures complained of caused adverse effects to the Class 
including, but not limited to, embarrassment, inconvenience, unfairness, mental distress, 
emotional trauma, pecuniary damages and the threat of current and future substantial harm from 
identity theft. In testimony to Congress on or about June 12, 2006, Defendant Nicholson said 
that although he remained hopeftil that the theft from the VA employee in Maryland was random, 
he and the VA could not count on the fact that no use of the stolen data was or would be made by 
imauthorized persons. 

39. The real threat of identity theft and similar adverse effects of VA's illegal actions 
and Privacy Act violations requires affirmative actions by the Class to recover peace of mind, 
emotional stability, and personal security including, but not limited to, frequently obtaining and 
reviewing credit reports, bank statements, and other similar information, obtaining credit watch 
services, and closing financial accounts. The Class has, and will continue to, suffer tangible and 
intangible damages for the foreseeable future. 

40. In Congressional hearings held after the disclosure of the Personal Information 
discussed herein, Representative Henry Waxman of California berated defendant Nicholson for 
his conduct and malfeasance: 
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"Secretary Nicholson, you blame this on an employee who was fired, on a culture, 
on people doing what they're not supposed to be doin'g. That doesn't sound like 
we're getting to the heart of this with passing the buck." 

CLASS ACTION ALLEGATIONS 

41 . This action is maintainable as a class action pursuant to Federal Rules of Civil 
Procedure 23(a) and (b)(l)-(3). 

42. The Class consists of all persons who have been adversely effected by 
Defendants' violations of the privacy of class members' personal and private identifying 
information. 

43. This action is properly maintainable as a class action for the following reasons: 

a. The Class is so numerous thatjoinderofall members is impractible. The 
class size is approximately 26,500,000, which is the number of individuals whose information 
Defendants admit was collected and maintained in the missing system of records. 

b. Joinder of class members* individual actions is impractical because of the 
geographical diversity of class members, the limited ability of individual class members to 
institute separate suits, and the general nature of the underlying action and relief sought. 

c. Plaintiffs are committed to the vigorous prosecution of this action and 
have retained counsel qualified and experienced to represent the Class and familiar with class 
litigation. Plaintiffs' claims are typical of the claims of other members of the Class and plaintiffs 
have no interest that are adverse or antagonistic to the interests of the Class. Plaintiffs are 
military veterans listed in one or more VA system of records who have had their personal 
infomiation improperly maintained and disclosed by Defendants. 

d. The representative Plaintiffs will fairly and_ adequately protect the interests 
of the Class. 
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e. There are substantial questions of fact and law conimon to all class 
members. The issues raised include whether Defendants acted or failed to act conamensurate 
with their duties to protect the personal, private and confidential information of Plaintiffs and 
class members, whether such conduct violated the privacy and other laws, whether said 
violations were willfiil, wanton and/or reckless and whether such conduct gives rise to the 
various forms of relief requested and/or damages. The foregoing issues are common to all class 
members. Similarly, the relief Plaintiffs seek is dominated by equitable remedies. The facts, 
circumstances, and merits of the case, therefore, apply equally to all class members. 

f. Defendants have acted and refused to act on grounds generally appHcable 
to the Class, making approprijate final injunctive and declaratory relief with respect to the Class 
as a whole. 

g. The prosecution of separate actions by individual class members would 
create a risk of inconsistent results that could establish incompatible standards of conduct for 
Defendants. 

h. Defendants' liability for damages can be established by facts and 
circumstances common to the Class as a whole and do not require the examination of Plaintiffs' 
individual circumstances. 

1. Questions of law and fact common to members of the Class predominate 

over any questions affecting only individual members. 

j. A class action is superior in this case to other methods for a fair and 

efficient adjudication of the controversy because the common interests of the class members 
predominate over any individual interest in controlling prosecution or control of separate actions 
and because concentrating the litigation in this Court is appropriate to ensure appropriate, 

13 
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consistent, and efficient resolution of the legal and constitutional issues raised in the district 
where the offending conduct occurred, continues to occur, and could occur in the ftiture. 

FIRST CLAIM FOR RELIEF 

44. Plaintiffs reassert the allegations set forth in Paragraphs 1 through 43 above and 
incorporate them by reference into this First Claim for Relief 

45. Defendant VA possesses personal information of Plaintiffs and millions of other 
veterans and active service members. VA has repeatedly demonstrated an inability or 
unwillingness to implement, or callous disregard for, fundamental procedures to provide 
minimally acceptable safeguards for the personal and private information in its possession. 

46. Defendant Nicholson is ultimately responsible in his official capacity for 
safeguarding citizen's private information under VA control pxirsuant to applicable laws, 
including the Privacy Act of 1974 and the Administrative Procedures Act, but has been unable or 
unwilling to require compliance with those laws. 

47. Defendants' actions and inactions in failing to safeguard Plaintiffs' private 
information were arbitrary, capricious, and otherwise not in accordance with law. 

48. Plaintiffs suffered, and continue to suffer, harm as a result of Defendants' actions 
and from actions improperly withheld or unreasonably delayed. 

49. The Class is entitled to monetary and equitable relief for Defendants' violation of 
plaintiffs' rights pursuant to the Administrative Procedures Act. 

50. The foregoing acts and omissions of Defendant VA constitute an xmauthorized, 
nonconsensual, and inappropriate disclosure of Social Security numbers and private health 
information of the Class in violation of 5 U.S.C. § 552a(b). 
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SECOND CLAIM FOR RELIEF 

5 1 . Plaintiffs repeat and reafBrm the assertions of fact contained in paragraphs 1 
through 50 hereinabove. 

52. The foregoing acts and omissions of Defendant VA constitute a willful and 
intentional failure to establish appropriate safeguards to ensure the security and privacy of 
veteran records and to protect against known and anticipated threats or hazards to the security 
and integrity of the private personal records of the Class in violation of 5 U.S.C. § 552a(e)(10). 

THIRD CLAIM FOR RELIEF 

53. Plaintiffs repeat and reaffirm the assertions of fact contained in paragraphs 1 
through 52 hereinabove. 

54. The foregoing acts and omissions of Defendants constitute a violation of the right 
to privacy and personal security of the Class in their Social Security numbers and private health 
information under the Fourth and Fifth Amendments to the United States Constitution. 

PRAY FOR RELIEF 
WHEREFORE, Plaintiffs pray as follows: 

a. For a declaration that Defendants' acts and omissions constitute a willful 
and intentional failure to establish appropriate safeguards to ensure the security and privacy of 
veteran and active service member records and to protect against known and anticipated threats 
or hazards to the security and integrity of these records in violation of 5 U.S.C. § 552a(e)(10) and 
the Fourth and Fifth Amendments of the United States Constitution. 

b. For preliminary and permanent injunctive relief enjoining, prohibiting and 
preventing Defendants from continuing to operate without appropriate safeguards to ensure the 



15 



(Jase 1:Uti-cv-01038-JR Document 9-2 Filed 07/1 0/2006 Page 33 of 50 



security and privacy of veteran records and to protect against anticipated threats or hazards to the 
security and integrity of these records. 

c. For reparative injunctive relief under Bivens requiring Defendants to take 
necessary measures to safeguard against the serious harm attendant to the improper 
disclosure/theft of confidential information including an identity and/or credit monitoring 
program and a preemptive internet search service for the benefit of Plaintiffs and the proposed 
Class under the Coxirt's supervision; 

d. That this Court permaneaitly enjoin Defendant VA, its officers, agents, 
employees, and those acting for and with them, fi-om accessing, viewing, handling, disclosing, or 
in any way transferring any record or systfem of records subject to Privacy Act requirements until 
an independent panel of experts finds that adequate information security has been established and 
implemented by VA, unless such activity is explicitly allowed by Court order and under 
supervision of persons independent of VA, such supervision to be at VA expense; 

e. That this Court enjoin Defendant VA, its officers, agents, employees, and 
those acting for and with them fi-om removing any device capable of storing, containing, or 
transferring any record or system of records, including, but not limited to, laptop computers, 
portable hard drives, memory stick or similar devices, and "iPods" and similar devices, firom 
property under VA's supervision and control until and unless VA demonstrates that adequate 
information security has been established to the Court's satisfaction. 

f. That this Court grant to Plaintiffs and the Class judgment against 
Defendant VA for damages in an amount of $1,000.00 for each individual who was adversely 
afflicted by Defendant's Privacy Act violations; 
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g. That this Court grant to Plaintiffs their costs and reasonable attorneys' 
fees; and 

h. That this Court grant such additional reUef as the Court deems proper and 
just. 
Dated: June 21, 2006 



WEISS &LURIE 




Joseph H.-^ei3s(JW- 
Mark D. Smilow (MS-2809) 
Richard A. Acocelli (RA-2029) 
Weiss & Lurie 
551 Fifth Avenue 
New York, NY 10176 
Tel: (212) 682-3025 
Fax: (212) 682-3010 



17 



Case 1:06-cv-01038-JR Document 9-2 Filed 07/10/2006 Page 35 of 50 



UJ 



■_^ 



vo 




o 


Eh W 


o 


«« 


CN 


D O 


a. 


0{!H 


^ 


U 




3: 


J^ 


Eh W 




U 2 




H 




K (w 




EhO 




CO 




H E^ 




QO 




H 




W « 




w &? 




Eh M 




rtj'a 




EhQ 




w 




?.- 13 




e P5 


6 


pa w 


z 


EH EH 


1 


fcy w 


a ri! 


^ 


P w 



>1 



> 

■H-P 

c 
(d o 
&e 

(d M 

> 

H 

(d o 

•H r- 
OCO 

-H 



M-l 

o 
to 

•H 



■H (d 
Id ■ 
m 
m 



IS 

o 

W -P 

o> 

a 

H 



o 

O 

O 

o 






(d 
+J 



o 
+> 

en 
c 

to- 
rt 
& 






-o 

H O 
ri! CM 



Q 



ca 

« -. 
W-P 
Eh Cn 

^ 

h to 
o td 

. & 

Eh 

W 

Eh 

< 01 
ft 

w 






E3 

> 

to < 

w 

EH-P 

£H 
CO £ 

D a> 
w > 

H O 

p «0 



to 

+J 
d 
(d 

G 
a) 
m 

0) 



EH 

s 

H 

«; 

2 
O 
U 



« 



to 

m 

■P 
C 

(/) -H 

_ H 
UJ ft 



1 
I 



J 



tS, H 
(^ I. 



§ 



10 ? 

in 111 

z 



<S 



& 

B 

o 



I 



I I 
CO Q 



V 

ci 



f 

CD 

.a 



5 



« O O 

:? >> " 
I S 8 



■^ 



•a 



I 

Q 



rH 
§« 

t/0 

I/O 

OJ 



•3 

I 

■g 



I 



u S 

t s 

: I 
° I 



CO 



I 



I 

.a 



■g g 



I 



S 

•d 





a 




s 




^ 


d 


■^ 


5 


u 


iS 


tS 


4> 


<»H 


^ 


o 


e 


§. 



g .5. 



•a 

3 



O 

o 



r W 

a H 

f3 t> 



^ 



I/) 

t>0 

tu 



E 



^ 
^ 






"Si 



Ll 

Z 
(il 
> 
< 

I 

li. 



in ^ 

in u 
z 



.2 



e 

o 



Case 1:06-cv-01038-JR Document 9-2 Filed 07/10/2006 Page 36 of 50 
Case 2:06-cv-001 14-WOB Document 3 Filed 06/07/2006 Page 1 of 15 

Eastern District of Kentucky 
FIL-ED 



IN THE UNITED STATES DISTRICT COURT 
FOR THE EASTERN DISTRICT OF KENTUCKY 



JUN - 7 2006 

AT COVINGTON 

LESLIE G WHITMER 

CLERK U S DISTRICT COURT 



PAUL HACKETT, 

1014 Vine Street, Suite 1690 

Cincinnati, OH 45202 

MATTHEW W. PAGE 
473 Beaver Road 
Walton, KY 41094 

Plaintiffs, 

vs. 

UNITED STATES DEPARTMENT 
OF VETERANS AFFAIRS, 
810 Vermont Avenue NW 
Washington, DC 20420, 

R. JAMES NICHOLSON, Secretary 

of the United States Department of 

Veterans Affairs, officially and 

individually, 

810 Vermont Avenue NW 

Washington, DC 20420, 

GORDON G. MANSFIELD, Deputy 
Secretary of the United States 
Department of Veterans Affairs, 
officially and individually, 
810 Vermont Avenue NW 
Washington, DC 20420, 

and 

JOHN DOE, employee of the 

United States Department of 

Veterans Affairs, officially and 

individually, 

c/o 810 Vermont Avenue NW 

Washington, DC 20420. 

Defendants. 
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I. PRELIMINARY STATEMENT 

1. Plaintiffs Paul Hackett and Matthew Page bring this action pursuant to the 
Privacy Act of 1974 and the Fourth and Fifth Amendments to the United States 
Constitution under the authority of Bivens u. Six Unknown Named Agents of the 
Federal Bureau of Narcotics, 403 U.S. 388 (1971) on behalf of themselves and all others 
similarly situated against the United States Department of Veterans Affairs ("VA"), 
Secretary R. James Nicholson, Deputy Secretary Gordon H. Mansfield, and its 
employee, John Doe.i 

2. Plaintiffs, veterans of the United States Marine Corps and United States 
Navy, respectively, are two of more than 28.5 million military veterans and active duty 
personnel whose private personal information, including Social Security numbers, were 
improperly, unlawfully, willfully and intentionally disclosed in at least three ways: (1) 
through the access and removal of data files containing the private personal information 
of more than 28.5 million veterans and active duty members from the VA facility by 
employee John Doe; (2) through the transfer of the data to external and unprotected 
disks and/or computers by John Doe; and (3) through the alleged theft of these disks 
and/ or computers by a third party, the identity of whom may never be known. These 
disclosures, made without Plaintiffs' knowledge or consent, violate 5 U.S.C. § 552a(b). 

3. These disclosures were the direct and proximate resiilt of Defendants' 
willful and intentional failure to establish and enforce appropriate safeguards to ensure 
the security and privacy of veteran and active duty personnel records and to protect 
against any known or anticipated threats or hazards to the security and integrity of these 



' Plaintiffs may also file an administrative charge alleging invasion of privacy pursuant to the Federal Tort 
Claims Act as required under 28 U.S.C. § i346Cb). 
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records in violation of 5 U.S.C. § 552a(e)(io). 

4. Subsequent to learning of these disclosures, Defendants were deliberately 
indifferent in failing to take reasonable corrective action, including but not limited to, 
providing prompt and accurate notification of the disclosures to law enforcement and 
the affected veterans despite knowledge of the substantial risk of serious harm to the 
personal and financial security of the affected veterans as result of the disclosures, 

5. Defendants' disclosures of Plaintiffs' confidential Social Security numbers 
also violated Plaintiffs' right to privacy and personal security of their Social Security 
numbers under the Fourth and Fifth Amendments of the United States Constitution. 

6. As result of the Defendants' acts and omissions in disclosing and failing to 
protect Plaintiffs' private personal information, including their Social Security numbers. 
Plaintiffs and those similarly situated have been placed at a substantial risk of harm in 
the form of identity theft and have incurred and will incur actual damages in an attempt 
to prevent identity theft by purchasing services to monitor their credit information. The 
remedies sought include declaratory and remedial injunctive relief, damages and 
reasonable attorneys' fees and costs. 

II. JURISDICTION AND VENUE 

7. The jurisdiction of this Court is invoked pursuant to 28 U.S.C. § 1331. 
Federal jurisdiction is appropriate in this instance to secure protection and to redress 
deprivations of rights guaranteed under 5 U.S.C, § 552a and Bivens. 

8. Venue is appropriate pursuant to 5 U.S.C. § 552a(g)(5) and 28 U.S.C. § 
1391(e), 
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III. PARTIES 

9. Plaintiff Paul Hackett is a veteran of the United States Marine Corps 
released from active duty in 1992 and honorably discharged from service in 1999. He is 
a resident of Hamilton County, Ohio. 

10. Plaintiff Matthew Page is a veteran of the United States Navy retired from 
active duty and honorably discharged from service in 2001. He is a resident of Boone 
County, KentuclQ^. 

11. Defendant VA is a cabinet of the Executive Branch of the United States 
Government which, in the course of its duties, compiles and maintains records of all 
individuals discharged from a branch of the United States military and provides benefits 
and services to veterans, including among other things, pension payments and health 
care. Upon information and belief, Defendant VA also compiles and maintains records 
of some or all active duty members of the United States military. 

12. Defendant R. James Nicholson is the duly-confirmed Secretary of United 
States Department of Veterans Affairs and is responsible for the enactment and 
enforcement of all VA policies and procedures, including those pertaining to safeguards 
to ensure the security and privacy of veteran and active duty records and to protect 
against any anticipated threats or hazards to the security and integrity of these records. 
He is sued in his official and individual capacities. 

13. Defendant Gordon H. Mansfield is the duly-appointed Deputy Secretary of 
the United States Department of Veterans Affairs and is responsible for the enactment 
and enforcement of all VA policies and procedures, including those pertaining to 
safeguards to ensure the security and privacy of veteran and active duty records and to 
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protect against any anticipated threats or hazards to the security and integrity of these 
records. He is sued in his official and individual capacities. 

14. Defendant John Doe is a long-time employee of the VA who was assigned 
as a data analyst. Upon information and belief, John Doe engaged in conduct 
tantamount to a willfd and intentional disclosure of and failure to protect the private 
personal information of Mr. Hackett, Mr. Page and the approximately 28.5 million other 
veterans and active duty personnel. He is sued in his official and individual capacities, 

IV. STATEMENT OF FACTS 

15. In connection with their honorable discharges afi:er service with the 
United States Marine Corps and United States Navy, Plaintiffs were required to provide 
the VA with their private personal information, including Social Security numbers. 

16. On or about May 22, 2006, Secretary Nicholson pubKcly announced 
through worldwide media outlets that the private personal information of approximately 
26.5 million veterans discharged after 1975 had been disclosed. Secretary Nicholson 
identified the private personal information of these veterans disclosed as their names, 
dates of birth, Social Security numbers, and, in some instances disability ratings and 
certain medical information. Nearly two weeks later, on or about June 6, 2006, 
Secretary Nicholson publicly announced that the files also contained these individuals' 
addresses and telephone numbers. 

Yj. On or about June 6, 2006, Secretary Nicholson publicly announced that 
the disclosure affected a much broader scope of individuals that initially reported on 
May 22, 2006, involving information of both veterans and active duty personnel. 
Specifically identified were 1.1 million active duty personnel, 430,000 members of the 
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National Guard, and 645,000 members of the Reserves. The private personal 
information of these individuals disclosed included names, addresses, telephone 
numbers, dates of birth, Social Security numbers, disability ratings, and upon 
information and belief, certain medical information. 

18. Secretary Nicholson reported the disclosure was connected to an alleged 
burglary of the home of Defendant John Doe. Upon information and belief, on or about 
May 3, 2006, John Doe, a data analyst and long-time VA employee, had removed VA 
files containing private personal information of more than 28.5 million veterans and 
active duty personnel from the VA facility and taken it to his home. John Doe then 
copied the files onto his computer and/or external disks for an unspecified purpose. 
John Doe's computer and/or disks were allegedly stolen during a burglary of his home. 
Upon information and belief, these items have not been recovered as of the date of the 
filing of this Complaint. They are not believed to be encrypted or password protected 
and can be easily accessed and duplicated. 

19. Upon information and belief, John Doe was able to easily access computer 
files containing private personal information of 28.5 million veterans and active 
personnel copy the files fi:om the VA's system onto external disks and his personal 
computer. Upon further information and belief, John Doe had been removing the data 
from the VA facility for a period of three years in a practice expressly or implicitly 
ratified by the VA. John Doe's access to and duphcation of this information was a 
disclosure in violation of 5 U.S.C. § 552a(b) and the result of Defendants' willful and 
intentional failure to establish appropriate safeguards to ensure the security and 
confidentiality of veteran and active duty personnel records and to protect against any 
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anticipated threats or hazards to the security and integrity of these records in violation 
of 5 U.S.C. § 552a(e)(l0). 

20. Upon information and belief, upon learning of the above-described 
disclosures, Secretary Nicholson and Deputy Secretary Mansfield unreasonably delayed 
reporting the disclosures to law enforcement agencies despite knowledge of the 
imminent and substantial risk of serious harm to the personal security of the affected 
veterans and active duty personnel. VA Inspector General George Opfer publicly stated 
that he was never formally notified of the disclosures, but rather heard about it through 
"gossip." 

21. Three weeks after the alleged burglary, on or about May 22, 3006, 
Secretary Nicholson advised media outlets that the 26.5 million veterans whose private 
persona] information was disclosed were subject to a heightened risk for identity theft. 
He urged the veterans to be "extra vigilant and to carefully monitor bank statements, 
credit card statements and any statements relating to recent financial transactions." 
Nearly two weeks later, on or about June 6, 2006, Secretary Nicholson advised media 
outlets that the disclosures involved nearly 2.2 million active duty members of the 
military as well. Upon information and belief, Defendants have not yet individiially 
notified the affected veterans. 

22. Defendants knew or should have known that their computer security 
practices were not in compliance with 5 U.S.C. § 552a as well as other federal laws 
relating to information security. In 2003, a study conducted by the General Accounting 
Office (GAO) gave the VA a failing grade for its computer security practices. In March 
2006, the United States House of Representative's Committee on Government Reform 
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gave the VA an "F" in its annual report card relating to information security. Despite 
this ample and specific notice of noncompliance and the potential adverse effect of 
random and unauthorized disclosures of personal information, Defendants failed to 
establish appropriate safeguards to ensure the security and confidentiality of veteran 
and active duty personnel records and to protect against any anticipated threats or 
hazards to the security and integrity of these records in violation of 5 U.S.C. § 
552a(e)(io). 

23. The unauthorized and unconsented disclosure of an individual's name, 
address, telephone number, date of birth and Social Security number creates a 
substantial risk of identity theft. An individual's Social Security number is the most 
useful identifier for retrieving information from public record databases, financial 
institutions and credit bureaus. Armed with an individual's name, address, date of birth 
and Social Security number, an identity thief is able to quickly and easily steal an 
identity, whereas, without such information, the task is difficult, time consuming and 
costly. 

24. Recent nationwide studies confirm that, on average, victims of identity 
theft spend hundreds of hours in personal time and hundreds of dollars in personal 
funds to resolve their credit issues. See www.idtheftcenter.org ; www.ftc.org . 

25. Defendants' unauthorized and unconsented disclosures of Plaintiffs 
private personal information and the imminent and substantial risk of identity theft to 
which Plaintiffs has been exposed is the direct result of Defendants' failm-e to: (1) 
establish appropriate administrative, technical and physical safeguards to ensure the 
security and confidentiality of records; (2) to protect against any anticipated threats or 
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hazards to the security and integrity of these records; and (3) to promptly take 
reasonable measures to correct the disclosures, including but not limited to, providing 
law enforcement and the affected veterans and active duty personnel with prompt and 
accurate notice of the disclosures. 

26. As a direct and proximate result of Defendants' acts and omissions, 
Plaintiffs have been exposed to a risk of substantial harm and inconvenience, and have 
incurred actual damages in purchasing comprehensive credit reports and/or monitoring 
of their identity and credit. 

V. CLASS ALLEGATIONS 

27. Plaintiffs maintain this action on behalf of themselves and all individuals 
whose private personal information, including Social Security numbers, were disclosed 
by Defendants in May 2006 as described above. 

28. The members of the putative class are so numerous that joinder of 
individual claims is impracticable. Moreover, there are significant questions of fact and 
issues of law common to the members of the putative class. These issues include 
whether Defendants failed to establish appropriate administrative, technical and 
physical safeguards to ensure the security and confidentiality of records and to protect 
against known and anticipated threats or hazards to the security and integrity of these 
records, whether such failure was willful and intentional, whether the putative class 
members were adversely affected, and whether they incurred actual damages as result. 

29. Plaintiffs' claims are typical of the claims of the putative class. Plaintiffs 
and all members of tbe putative class have been adversely affected and damaged in that 
their private information has been compromised and stolen. 



Case 1:06-cv-01038-JR Document 9-2 Filed 07/10/2006 Page 45 of 50 
Case2:06-cv-00114-WOB Documents Filed 06/07/2006 Page 10 of 15 



30. The proposed class representatives will fairly and adequately represent the 
putative class because they have the class members' interest in mind, their individual 
claims are co-e5ctensive with and identical to those of the class, and because they are 
represented by qualified counsel experienced in class action litigation of this nature. 

31. A class action in this instance is superior to other available methods for the 
fair and efficient adjudication of these claims since individual joinder of the claims of all 
members of the putative class is impracticable. Most members of the class are without 
the financial resources necessary to pursue this matter. Even if some members of the 
class could afford to litigate their claims separately, such a result would be unduly 
burdensome to the courts in which the individualized cases would proceed. Individual 
litigation increases the time and expense of resolving a common dispute concerning 
Defendants' actions toward an entire group of individuals. Class action procedures 
allow for far fewer management difficulties in matters of this type and provide the 
unique benefits of unitary adjudication, economy of scale and comprehensive 
supervision over the entire controversy by a single court. 

32. The putative class may be certified pursuant to Rule 23(b)(1) of the 
Federal Rules of Civil Procedure because inconsistent or varying adjudications with 
respect to individual class members would establish incompatible standards of conduct 
for Defendants to follow. 

33. The putative class may be certified pursuant to Rule 23(b)(2) of the 
Federal Rules of Civil Procedure because Defendants have acted on grounds generally 
applicable to the putative class thereby making final injunctive relief and corresponding 
declaratory relief appropriate with respect to the claims raised by the class. 

10 
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34. The putative class may be certified pursuant to Rule 23Cb)(3) of the 
Federal Rules of Civil Procedure because questions of law and fact common to class 
members will predominate over questions affecting individual members and a class 
action is superior to other methods for fairly and efficiently adjudicating the controversy 
and causes of actions described in the Complaint. 

VI. STATEMENT OF CLAIMS 
COUNT ONE 

35. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs i through 34 herein above. 

36. The foregoing acts and omissions of Defendant VA constitute an 
unauthorized, nonconsensual, and inappropriate disclosure of Plaintiffs' Social Security 
numbers in violation of 5 U.S.C. § 552a(]b). 

COUNT TWO 

37. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 36 herein above. 

38. The foregoing acts and omissions of Defendant VA constitutes a willful 
and intentional failure to establish appropriate safeguards to ensure the security and 
privacy of veteran and active duty personnel records and to protect against known and 
anticipated threats or hazards to the security and integrity of Plaintiffs private personal 
records in violation of 5 U.S.C. § 552a(e)(io). 

COUNT THREE 

39. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 38 herein above. 

11 
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40. The foregoing acts and omissions of Defendants Nicholson, Mansfield and 
John Doe constitute a violation of Plaintiffs' right to privacy in their Social Security 
numbers under the Fourth and Fifth Amendments to the United States Constitution. 

COUNT FOUR 

41. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 40 herein above. 

42. The foregoing acts and omissions of Defendants Nicholson, Mansfield and 
John Doe constitute a violation of Plaintiffs' right to personal security under the Fourth 
and Fifth Amendments to the United States Constitution. 

COUNT FIVE 

43. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 42 herein above. 

44. The foregoing acts and omissions of Defendants Nicholson, Mansfield and 
John Doe deprived Plaintiffs of their right to procedural and substantive due process 
under the Fifth Amendment to the United States Constitution. 

COUNT SIX 

45. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 44 herein above. 

46. The foregoing acts and omissions of Defendants Nicholson, Mansfield and 
John Doe were done in deliberate indifference to rights guaranteed to Plaintiffs under 
the Fourth and Fifth Amendments to the United States Constitution. 
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VII. PRAYER FOR RELIEF 
WHEREFORE, Plaintiffs, on behalf of themselves and all others similarly 
situated, hereby demand judgment against Defendants as follows: 

a. For a declaration that Defendants' acts and omissions constitute a willful 
and intentional failure to establish appropriate safeguards to ensure the security and 
privacy of veteran and active duty personnel records and to protect against known and 
anticipated threats or hazards to the security and integrity of these records in violation 
of 5 U.S.C. § 552a(e)(io) and the Fourth and Fifdi Amendments of the United States 
Constitution. 

b. For preliminary and permanent injunctive relief enjoining, prohibiting 
and preventing Defendants from continuing to operate without appropriate safeguards 
to ensure the security and privacy of veteran and active duty personnel records and to 
protect against anticipated threats or hazards to the security and integrity of these 
records. 

c. For reparative injunctive relief under Bivens requiring Defendants to take 
necessary measures to safeguard against the serious harm attendant to the improper 
disclosure/theft of confidential information including an identity and/or credit 
monitoring program and a preemptive internet search service for the benefit of Plaintiffs 
and the proposed class imder the Court's supervision; 

d. For an award of damages for Plaintiffs and each affected class member in 
an amount no less than $1,000.00; 
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e. For an award of reasonable attorney fees and costs incurred by Plaintiffs 
and the members of the putative class in prosecuting this matter; and 

f . For an award of such other relief in law and equity to which Plaintiffs and 
the members of the putative class may be entitled under the premises. 

Respectfully subpart 
MEZIBOV/&JEN] 




MAKCTD. MEZIBOV (Ohio Bar No. 0019316;) 
401 East Court Street, Suite 600 
Cincinnati, Ohio 45202 
Telephone: (513) 723-1600 
Telecopier: (513) 723-1620 
mmezibov(5>mezibovienkins.com 

Attorney for Plaintiffs 

Of Counsel: 

MEZIBOV & JENKINS, CO. L.P.A 

CHRISTIAN A. JENKINS (Ohio Bar No. 0070674) 
STACY A. HINNERS (Ohio Bar No. 0076458) 
401 East Court Street, Suite 600 
Cincinnati, Ohio 45202 
Telephone: (513) 723-1600 
Telecopier: (513) 723-1620 
cjenldns(fl)mezibovienkins.com 
shinnerscgimezibovjenkins.com 

MURDOCK, GOLDENBERG, SCHNEIDER & 
GROH LPA 

JOHN C. MURDOCK (Ohio Bar No. 0063749) 
JEFFERY S. GOLDENBERG (Ohio Bar No. 0063771) 
35 East Seventh Street, Suite 600 
Cincinnati, OH 45202 
Telephone: (513) 345-8291 
Telecopier: (513) 345-8294 
jmurdock@mgsglaw.com 
jgoldenberg@mgsglaw.com 
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CERTIFICATE OF SERVICE 

A true and accurate copy of the foregoing was filed with the Clerk and served to 
the following via regular U.S. mail on this 7* day of June 2006: John C. Murdock and 
Jeffeiy S. Goldenberg, 35 E. Seventh Street, Suite 600, Cincinnati, OH 45202; Alberto 
Gonzalez, United States Attorney General, Department of Justice, 950 Pennsylvania 
Avenue NW, Washington, DC 20530-0001; Amul R. Thapar, United States Attorney for 
the Eastern District of Kentucky, 110 West Vine Street, Suite 400, Lexington, KY 
40507-1671; United States Department of Veterans Affairs, 810 Vermont Avenue NW, 
Washington, DC 20420; R. James Nicholson, Sio^ermont M/gaae N\f^^36JasMiigrop, 
DC 2042o;GordonG.MansMd, 810 Vermont AbenueNW/Washing^, DC 2042,0' 
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MARC D. MEZIBOV (Ohio Bar No. 0019316) 
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